KPMG 2026 Report: AI Rules Diverge as Tokenization Goes Mainstream
KPMG's annual asset management regulation report, published on 14 October 2026, lands a clear verdict: the global regulatory environment for digital innovation is no longer converging. AI oversight is fracturing along jurisdictional lines, tokenization has crossed from pilot into operational reality in leading financial centres, and digital asset rules are being retooled to align with traditional finance standards. For accounting firms, CFOs, and auditors advising asset managers, the report signals that the window for treating these as future-state problems has closed.
AI Regulation: Divergence, Not Convergence
The report's opening finding on artificial intelligence is striking precisely because it runs counter to the assumption that global regulatory coordination was building steadily. KPMG identifies two distinct camps forming among regulators and policymakers.
Technology-Neutral Jurisdictions Hold Their Ground
A significant group of jurisdictions continues to rely on existing, technology-neutral frameworks to govern AI deployment in financial services. The logic is that existing obligations around governance, accountability, and consumer protection already apply to AI-driven decisions without the need for dedicated AI legislation. These regulators are updating guidance incrementally rather than legislating from scratch, which gives firms operating under their remit a degree of continuity but also leaves interpretive gaps.
Early AI-Specific Rules Are Being Walked Back
More surprising is the second dynamic: some jurisdictions that moved early to introduce AI-specific requirements are now pulling back from those rules. KPMG attributes this partly to the speed of AI's evolution outpacing the frameworks designed to contain it, and partly to competitive pressure from jurisdictions that chose a lighter-touch approach. The practical effect is that firms operating across borders face genuinely inconsistent compliance obligations, not just differences in timing or emphasis, but structurally different regulatory models.
What This Means for Governance Structures
KPMG's recommendations to asset managers on AI are worth reading as accounting and audit obligations in disguise. The report calls on firms to identify which AI use cases deliver the most value and to back those deployments with rigorous governance and oversight. Critically, it emphasises accountability for decisions taken and outcomes delivered across the entire AI lifecycle. For auditors, that framing maps directly onto audit trail requirements: if an AI model influences a pricing, risk, or compliance decision, the accountability chain must be documentable. Firms relying on AI-assisted tools for financial reporting or portfolio valuation will need to demonstrate that a human with appropriate authority reviewed and accepted the output, not merely that the model ran.
Tokenization: From Pilot to Operational Reality
The more immediately consequential finding for accounting practitioners is on tokenization. KPMG characterises the shift as one from experimentation to active market-shaping, at least among leading financial centres. Regulators in those jurisdictions are no longer designing sandbox environments; they are building regulatory infrastructure intended to support live, scaled activity.
Leading Centres Are Racing to Set the Rules
The report notes that major financial hubs are moving simultaneously on three fronts: drafting or finalising rules, building the market infrastructure those rules will govern, and competing to attract issuers and intermediaries. That three-front dynamic means the rules being written now are likely to be the durable ones, not interim arrangements subject to wholesale revision. Firms that engage with those frameworks early gain the practical advantage of shaping implementation guidance, not just complying with it after the fact. This connects to the broader infrastructure debate playing out in Europe: for context on how the EU DLT Pilot Regime cap expansion reshapes tokenized-security infrastructure, the legislative trajectory already in motion is instructive.
Laggard Jurisdictions Face a Catch-Up Problem
KPMG is candid that other jurisdictions are progressing at a slower pace. The risk for firms headquartered or licensed in those markets is not merely competitive; it is operational. If an asset manager's primary regulator has not yet clarified how tokenized fund units are to be classified, valued, or reported, the firm faces a choice between waiting for clarity (and falling behind peers) or acting on reasonable interpretations (and accepting residual regulatory risk). Neither option is cost-free.
Accounting and Audit Pressures from Tokenized Assets
Tokenized assets that move from pilot to production create accounting obligations that many firms have not yet stress-tested at scale. The key questions are classification, measurement, and disclosure. Under IFRS, the classification of a tokenized asset depends on the rights it conveys, not the technology it runs on. A tokenized bond is still a bond; a tokenized fund unit may be equity or a liability depending on the fund's structure. What changes is the operational complexity: settlement can be near-instantaneous, positions can update continuously, and the chain of custody is recorded on a distributed ledger rather than a central counterparty's books.
For teams using digital asset accounting software, the practical demand is for systems that can ingest on-chain transaction data at the granularity the ledger produces, map it to the correct accounting treatment, and produce audit-ready records. Firms that built their crypto bookkeeping software workflows around end-of-day batch imports from a single exchange will find those architectures insufficient for institutional tokenization activity involving multiple ledgers, smart contract interactions, and fractional ownership structures.
The recent live example of what this looks like in practice is useful here: what the DRW and Marex tokenized index swap means for OTC accounting workflows illustrates the specific data and reconciliation challenges that arise when a tokenized instrument settles on a permissioned network without a traditional CCP in the middle.
Digital Asset Rules: Aligning with Traditional Finance
The third strand of KPMG's report addresses the broader digital asset regulatory landscape. The headline observation is that regulators are enhancing requirements for cryptoasset providers to ensure compatibility with traditional finance obligations, while strengthening investor protection alongside that alignment.
Convergence with TradFi Requirements
This is a meaningful shift in regulatory philosophy. Early crypto regulation in most jurisdictions was additive: new registration categories, new disclosure requirements, new custody rules, layered on top of, or sometimes in lieu of, existing frameworks. The current direction is integrative: crypto asset service providers are increasingly expected to meet the same substantive standards as licensed investment firms or fund managers, with bespoke modifications where the technology genuinely differs rather than across-the-board carve-outs.
For accounting firms advising digital asset businesses, that means the audit methodology for a crypto asset manager is converging with the methodology for a traditional asset manager. Client money rules, conflicts of interest disclosures, best execution obligations, and prudential capital requirements are all migrating into the crypto space. Firms that built compliance and audit programmes on the assumption that crypto was a separate, lighter-touch regulatory universe need to reassess that assumption now.
Investor Protection as a Live Constraint
KPMG's guidance to regulated firms includes a specific instruction to verify that digital asset products reach only their intended target market and that effective risk management arrangements are in place. That language mirrors the product governance requirements embedded in frameworks like MiFID II, and its appearance in guidance directed at digital asset managers signals that regulators expect those standards to apply, not as aspirational best practice but as enforceable obligation. For auditors, it raises the question of whether existing client procedures adequately test product governance controls in the digital asset context.
Implementation Priorities: What Firms Should Be Doing Now
KPMG's action list for firms is framed around strategy rather than compliance checklist, which is the right framing. The report asks asset managers to develop a digital assets and tokenization strategy that covers target operating models, investment priorities, and capability requirements. For accounting and audit practices advising those managers, the parallel task is ensuring that the firm's own delivery infrastructure, its crypto accounting software stack, its staff competencies, and its methodology library, can support clients operating in the environment KPMG describes.
Governance Across the Full Lifecycle
The report's repeated emphasis on lifecycle governance is not accidental. Both on AI and on digital assets, KPMG frames the risk as one of incomplete governance: firms that deploy technology without ensuring accountability at every stage, from design through decommission. For CFOs and finance teams, lifecycle governance has a direct accounting corollary. An asset that is tokenized, traded, redeemed, and then the underlying smart contract deprecated needs to be accounted for at each stage, and the accounting records need to be traceable even after the on-chain activity is complete.
Infrastructure Resilience Testing
KPMG calls explicitly for testing the resilience of new infrastructure. In an accounting context, that translates to testing whether data pipelines from distributed ledgers to general ledgers are robust, whether reconciliation processes can handle failed transactions or reorgs, and whether backup procedures exist if a node or oracle becomes unavailable. These are operational questions, but they have direct financial reporting implications: if the data feed fails, the period-end balance is unreliable.
Frequently Asked Questions
Does KPMG's report identify specific jurisdictions as leading or lagging on tokenization?
The published excerpt characterises leading financial centres as actively building rules and infrastructure without naming them individually. The framing implies jurisdictions with established capital markets and existing fintech regulatory frameworks, but the report does not produce a ranked list in the portion available.
How should an accounting firm treat a tokenized fund unit under IFRS?
Classification follows the rights conveyed, not the technological form. A tokenized unit that entitles the holder to a pro-rata share of net assets with redemption rights is likely a financial liability of the fund under IAS 32. One structured as equity without a contractual obligation to redeem would be classified differently. The token wrapper does not change the underlying analysis, but it does introduce new measurement and disclosure complexities around on-chain custody and transaction costs.
What is the accounting risk from AI-driven decisions in financial reporting?
The primary risk is attribution: if an AI model produces a valuation, classification, or disclosure that is later found to be incorrect, the firm must demonstrate that a competent human reviewed and approved the output. If that review chain is absent or poorly documented, the firm faces both a financial reporting risk and a potential audit finding. KPMG's emphasis on accountability for AI outcomes is directly relevant to this exposure.
What does "infrastructure resilience testing" mean in practice for a finance team?
It means verifying, before a period end, that every data feed from a distributed ledger or custody provider to the accounting system produces complete, accurate, and timely records. It also means having documented procedures for what happens when a feed fails: who is notified, what manual override process applies, and how the resulting records are flagged in the audit trail.
How does the convergence of crypto rules with traditional finance affect audit scope?
As regulators align cryptoasset provider obligations with those of licensed investment firms, auditors will increasingly need to test controls that were previously outside crypto-specific audit programmes: product governance, conflicts of interest, best execution, and prudential capital adequacy. Firms that have not updated their digital asset audit methodology since the initial licensing wave in their jurisdiction should review their programmes against current regulatory expectations.
Source: KPMG Digital Assets